fix(cli): redact access token from MCP auth status output

[ch1lam]

Summary

• Replace partial access token display with "present" in MCP auth status output
• Prevents token leakage via screen recordings, terminal logs, or shoulder-surfing

Motivation

The mcp auth status command printed the first 20 characters of the OAuth access token. Even a partial token can be captured and potentially used. The refresh token was already displayed as just "present" — the access token should follow the same pattern.

Changes

// Before
prompts.log.info(`  Access token: ${entry.tokens.accessToken.substring(0, 20)}...`)

// After
prompts.log.info(`  Access token: present`)

Fixes #155

[qiaozongming]

#953

[qiaozongming]

#1108